Executive brief
JetBrains IntelliJ IDEA, a popular development environment used by software engineers, contains a vulnerability that could allow an attacker to execute malicious code on a developer's machine. This occurs when the software handles specific project workspace identifiers, potentially leading to a full system compromise or theft of intellectual property. Organizations should ensure developers update to the latest patched versions to prevent unauthorized access to their development environments.
Technical details
A path traversal vulnerability (CWE-23) exists in JetBrains IntelliJ IDEA versions prior to 2026.1.4 and 2026.2. The flaw is located in the project workspace ID handling logic, where insufficient validation of input allows for directory traversal. An attacker can exploit this by tricking a user into interacting with a malicious project or workspace configuration, leading to arbitrary code execution with the privileges of the IDE user. The vulnerability has a CVSS score of 9.6, reflecting its high impact on confidentiality and integrity. Users are advised to update to version 2026.1.4 or later.
Affected products
- JetBrains IntelliJ IDEA before 2026.1.4, 2026.2
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory